Today, we’re going to run through some of the most commonly asked questions that we’ve been getting, pertaining specifically to the extension of the PSD2 SCA compliance date. We hope that this will clear up any confusion surrounding this topic, while also serving as a resource going forward. If you still have questions after combing through these questions, please reach out; we will be happy to talk through them with you.
Q: Why is the effective date for PSD2 SCA no longer being enforced?
A: There was a strong feeling in the European Economic Area (EEA) and around the industry that urging merchants, issuers, payment service providers and others to comply by the original date – September 14 – would’ve significantly hampered digital commerce in the affected regions. Since this forecasted effect is antithetical to everything this mandate is trying to accomplish, the competent authorities in individual counties began submitting extension plans for more time to ensure their readiness.
Q: What is the timeframe of the PSD2 SCA compliance plan that’s been proposed in certain EEA countries?
A: Some countries have indicated that they are delaying the enforcement of this mandate for an additional 18 months after September 14, 2019, which would take us into March 2021. In total, there have been approximately 20 countries who have either acknowledged or announced that a temporary extension is necessary. Most of these countries, however, have not fully defined the length or exact scope of the delays yet. Right now, everyone isn’t on the same page when it comes to the length of the delay, but more details should arise in the next few months.
Q: Is there going to be a new uniform effective date?
A: We do know that Visa and Mastercard have publicly come out in favor of a harmonized approach across all EEA countries for PSD2 SCA compliance, rather than the singular approach that individual countries are employing right now. Visa and Mastercard were also backed by the European Association of Payments Service Providers for Merchants (EPSM), the European Tourism Association (ETOA), the European Hotel Forum (EHF), the European Payment Institutions Federation (EPIF), Ecommerce Europe and EuroCommerce.
Q: Are there any other important dates on the calendar that we should know about?
A: Now that you mention it, there are! Visa has collaborated with the industry to recommend an 18-month transition period across all member states, which would provide sufficient time for all parties to make the necessary technical changes. Taking any additional time, beyond September 14, 2019, to get ready will depend on the position of the European Banking Authority (EBA) and your local regulator(s). The SCA requirement went into effect on September 14, 2019. But the EBA has accepted that local regulators may decide to work with PSPs and other stakeholders, to provide a transition period that gives all parties more time to get ready. More and more local regulators have publicly stated that SCA compliance will not be enforced on September 14, 2019.
We understand that your number one priority is successfully selling to your customers with a seamless purchasing experience. Visa is working with clients and regulators to ensure the industry moves in the right direction, even taking the steps to revise the requirements to ensure all clients are ready.
Visa has created an 18-month roadmap to accelerate the ecosystem with key milestones that all clients need to achieve (subject to the 18-month transition period being adopted by the EBA and your local regulator(s):
- Feb 1, 2020 – Visa EMV 3DS performance programs start and will monitor Visa clients to ensure they are meeting program performance rules
- Mar 14, 2020 – Issuers need to be fully live with EMV 3DS 2.1. Merchants should be actively testing EMV 3DS 2.1 and 2.2.
- Sept 14, 2020 – Issuers need to be live on EMV 3DS 2.2.
- Mar 14, 2021 – Active supervision, issuers decline.
Q: Are there some countries that are still abiding by the original effective date?
A: Great question! Since all of the countries in the European Union (EU) have been granted the freedom to approach this delay however they see fit, there may still be some places that require SCA on Card-Not-Present transactions directly after the original effective date – September 14.
However, they can adopt the Visa roadmap that was recently released if they agree to. In the meantime, merchants and issuers should follow network communications, at least until their local competent authorities formally acknowledge or submit individual plans for approval by the EBA.
That’s it for this round of FAQs. We hope that you were able to learn a little more about the delayed enforcement of PSD2 SCA, including why this was a necessary change. Next week, we’re going to look more specifically at how this delay affects merchants, issuers, payments service providers and others in the industry.
We recognize that there’s still a lot to learn when it comes to this situation, which is why we will be disseminating any new information as soon as we get it. We want you to be as informed as possible on this situation, as it’s currently one of the most important stories in our industry. Stay tuned for more!